Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm taking a course which is designed with the CISSP certification in mind. Though the class is categorized as software engineering, we talked a lot about physical security and, in particular, floods, fires, earthquakes and cars running into things. How is this security? For example we were told that data centres are safest in the middle of a building because if the roof was leaking the top wouldn't be safe, and water tends to go down so the lower floors would be the first to flood.

Is this really a security issue? For example, if the roof leaks the engineer would be at fault, not the security analyst. You wouldn't hire a security analyst to make sure the roof is solid.

UPDATE: Also, things like having bollards around a building to protect pedestrians from cars, how's this security? No one's really explained this yet. I was told the companies most valuable assets are their employees, but with this line of reasoning, what isn't security?

If the availability is so encompassing, what isn't part of security?

share|improve this question
3  
You quickly apply the physical security question to an "analyst". The CISSP is for higher level security folks than those at the analyst level. Do you want to know why the CISSP includes natural disasters or why an analyst should care? – schroeder Jan 10 at 16:35
8  
If the course is designed towards CISSP, then it is not a software engineering course. Information security includes paper records, personal security, availability of services etc – Rory Alsop Jan 10 at 16:58
4  
Do you really care what is attacking your data? Does it make a difference to you (and more importantly, to how you protect it) if someone is intentionally destroying your data center or if a natural weather phenomena is? – corsiKa Jan 11 at 7:13
9  
"if the roof leaks the engineer would be at fault" but if this results in any security problem, the security analyst is at fault. The goal is not to find someone to blame but to keep the resources available and secure. Your goal should be to have every possibility considered. If the roof leaks you should either have written somewhere that this is a risk the company is willing to accept or have mitigations. But in any case, it is your job to have considered it! – Josef Jan 11 at 8:25
2  
Of course they will make sure to have a good quality roof. But it is your responsibility as a security analyst to make sure the roof is good. With CISSP you ate not a computer guy. You are responsible for security and the roof, doors, walls... are part of that! – Josef Jan 11 at 9:00

All other answers are fine. I'm going to offer you a classic security perspective.

  • Starting a fire/flood is a textbook scenario for physical penetration/exfiltration. People under stress are less likely to challenge strangers.

  • A fire can be used to destroy forensic evidence, in particular when there's insider involvement.

  • An earthquake or, indeed, any natural disaster (like bush fires) is a potential complication for security because law and order break down and looting rears its ugly head.

  • Perimeter security against SVBIEDs is a necessary consideration in certain countries and threat environments. If a suicide car bomber can drive close to the walls of your data center, it is your failure as a security consultant. Hence bollards, flowerbeds, and concrete barriers.

  • Security is a holistic discipline. Every specialist cares about bits and pieces of the enterprise, and by necessity of life loses sight of the whole. There should be at least one person out there who thinks in terms of adversary's behavior and not his/her own pigeonhole. Which, incidentally, is a security consultant's job description.

share|improve this answer
15  
Especially strangers wearing yellow trench coats who came in with legitimate firefighters. – corsiKa Jan 11 at 7:14
    
I'm pretty sure that's such a common use case that it's even a tvtrope. But I don't want to get sucked into that hole so I'm not going to look for a link ;) – Wayne Werner Jan 13 at 0:57

It comes down to the classic security triad; Integrity, Confidentiality and Availability. The last of which could certainly suffer from any type of natural disaster, which is why you must include it in your continuity plan.

share|improve this answer
3  
Isn't that an overly pedantic view of availability? If there's someone using a computer that you need to be on, you wouldn't say that's a security problem. – Celeritas Jan 10 at 1:22
16  
@Celeritas: Sharing a computer with someone has a pretty low bar for security; availability isn't that critical in that situation. But if you're a company where your integrity and availability really are important, natural disasters could ruin you. Image if your bank flooded and they lost all your money (or you lost access to your money for a very extended period of time). Or imagine you're an email provider and a car crashes into your building: your users are going to be in trouble if that caused you to lose their data (or prevented access for a prolonged period). – Cornstalks Jan 10 at 3:54
4  
@ToddWilcox risks of integrity and confidentiality is very likely to be affected by your response to a natural disaster. For example, if some office or data center is physically unavailable due to a natural disaster, most companies will still continue working with confidential data and make sensitive financial decisions no matter what, even if the ordinary secure environment is unavailable, or some usually mandatory verifications are simply skipped because the needed data or systems are unavailable. You need to secure also your 'failover' process/procedures, not only business as usual. – Peteris Jan 10 at 21:13
4  
@Celeritas: The denial of service attack a common example of an availability issue in security. – Venge Jan 11 at 10:55
7  
@Celeritas: It's not "anything that hampers availability is a security issue". Amazon being a few seconds slower at Christmas is an acceptable degradation of service and therefore not a security issue; taking 600 seconds to serve a page is undoubtedly a denial of service for Amazon. Somewhere on the spectrum between 1 and 600 there comes a point where you stop thinking of it as slightly inconveniencing your customers and start thinking of it as losing your customers. – Eric Lippert Jan 11 at 14:09

CISSP is an information security certification not a computer security certification.

Information security is about the protecting the confidentiality, integrity, availabity of information in general. Information is not only stored on computers. They are printed out and stored in filing cabinets, they are memorized and stored in your employee's brains. Therefore, apart from ensuring that your computer networks are secure, you need to ensure physical security of your premises. If those confidential documents are stolen or destroyed in a disaster, it is also a loss of availability. If your employees sell the information to a competitor, then it is considered a loss of confidentiality. That is why policies and physical security measures are important.

share|improve this answer
1  
this makes more sense for me :) – Cerlin Boss Jan 12 at 5:18
2  
Exactly! CISSPs Job is to guarantee the security of the information. And if it leaks you can't dance around and play the blame game. It is your responsibility to guarantee the safety and if it fails it is your fault. That is why you get a nice compensation. – Falco Jan 12 at 12:54

Even if you take a narrow view of computer security as being limited to dealing with intentional malicious attacks, any way in which your system is vulnerable to a natural disaster also represents a way in which a well-equipped (or clever) attacker could disrupt your service. For example, if a data center is vulnerable to flooding, someone who wants to take it offline could cut a sprinkler pipe in the building. So it makes sense to protect against natural disaster scenarios as part of an overall security plan.

share|improve this answer

Disasters are as much a security issue as mitigating denial of service attacks. In the ISC2 (CISSP) docs, security is often represented by the CIA triad: Confidentiality, Integrity and Availability. Disaster recovery strategies and DDOS mitigation both pertain to establishing and maintaining availability.

share|improve this answer

I'll toss in my 2c and mention something that others have not specifically mentioned: Business Continuity Plans

BCP is an important function of a security analyst's job, and as such, the CISSP provides a broad overview of the issues that can impact disasters and outages. Knowing these high-level details helps the CISSP build a foundation for knowledge and the mindsets required to do BCP.

Please note that what is covered in the CISSP material is a broad, high-level overview of the topics. There is much, much more a Security pro needs to know and consider to properly create and manage a BCP program.

share|improve this answer

If we look in a dictionary one of the secondary meanings of "security" is:

the ​fact that something is not ​likely to ​fail or be ​lost

While we often think of Information Security as guards, guns, and hackers in dark glasses, what it is really about is protection of information from threats. These threats could be:

  • External attackers - hackers
  • Malicious insiders
  • Natural disasters
  • Technical problems - leaks, power outages
  • Honest mistakes - like losing a CD full of data
  • A lot more!

The reason CISSP covers all these is that an organisation needs someone to look after these issues. Turns out the sort of things you do to defend against the threats are pretty similar, so it makes sense to have one department take care of them.

share|improve this answer

I'm going to turn it around:

Disaster planning is not part of security, because security is part of disaster planning.

Disaster Planning, which is made up of Disaster Prevention and Disaster Recovery, covers a range of topics (e.g. redundancy, backups) including security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.